topic Re: min max in Splunk Search

Is there another way to use min max?

karu0711 — Fri, 14 Apr 2023 20:39:47 GMT

I am running search.
basesearch |eventstats count values(date) as Date by ID

result I get count 2 or 3 or 1
how do I get count=1 OR count=3.
how I use max(count) and min(count).
I need this because min(count) will new data and max(count) will old data.
Is there any other way to do this?

Re: min max

ITWhisperer — Fri, 14 Apr 2023 19:05:40 GMT

Perhaps you mean streamstats to number the events which would normally be in reverse chronological order i.e. newest first?

basesearch | streamstats count by ID

Re: min max

karu0711 — Fri, 14 Apr 2023 20:00:11 GMT

but I want only output new finding separate table and old in separate table.

Re: min max

ITWhisperer — Fri, 14 Apr 2023 20:16:36 GMT

For new use:

basesearch | streamstats count by ID | where count == 1

For old use:

basesearch | streamstats count by ID | eventstats max(count) as last by ID | where count == last